Interception method and apparatus based on local breakout

ABSTRACT

The present disclosure provides a method and a device for interception based on Local Break Out (LBO). The method includes: receiving, by a small base station, an interception task instructing the small base station to intercept an interception target; intercepting, by the small base station, LBO data of the interception target based on the interception task to obtain intercepted data; and transmitting, by the small base station, the intercepted data. The present disclosure can solve the problem in the related art that data of an interception target cannot be intercepted in an LBO scenario.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a national phase entry under 35 U.S.C. § 371 ofInternational Patent Application PCT/CN2017/076903, filed Mar. 16, 2017,designating the United States of America and published as InternationalPatent Publication WO 2017/157314 A1 on Sep. 21, 2017, which claims thebenefit under Article 8 of the Patent Cooperation Treaty to ChinesePatent Application Serial No. 201610154505.2, filed Mar. 17, 2016.

FIELD

The present disclosure relates to communication technology, and moreparticularly, to a method and a device for interception based on LocalBreakOut (LBO).

BACKGROUND

With the rapid development of smart terminals and video technologies,data in mobile networks increases explosively. In order to reduce theload on a core network device (Evolved Packet Core, or EPC) of a mobilenetwork, some local datagrams for low added-value services may be routeddirectly to a Public Data Network (PDN). This is referred to as LocalBreak Out (LBO). FIG. 1 is a schematic diagram showing a networkdeployment in an LBO service application scenario.

As shown in FIG. 1, after a User Equipment (UE) has entered a network,its IP datagrams transmitted from a base station are routed directly tothe Internet. That is, the base station serves as the last hop for amobile network device to offload user traffic data locally to theInternet. The LBO has an increasingly wider range of applicationscenarios in mobile networks.

Lawful Interception (LI) is an action allowed by law to interceptcommunications. Conventionally, the LI technique is provided accordingto standards defined by the 3^(rd) Generation Partnership Project(3GPP). FIG. 2 shows an LI architecture for Serving Gateway(S-GW)/Packet Data Network Gateway (PDN-GW)/evolved Packet Data Gateway(ePDG) in an Evolved Packet System (EPS) defined in 3GPP TS 33. 107.

In FIG. 2, the Law Enforcement Monitoring Facility (LEMF) is amonitoring device, the Mediation Function, ADMinistration Function(ADMF), Delivery Function2 and Delivery Function3 are all LI devices.For the purpose of description, they are referred to as LawfulInterception Gateway (LIG) collectively. In the figure, an X1_1interface is provided for transmitting an interception instruction to anintercepted device, an X2 interface is provided for transmittingInterception Related Information (IRI) associated with signaling controlin a mobile network, and an X3 interface is provided for transmittingintercepted Communication Contents (CCs).

In an interception request transmitted via the X1_1 interface, only theinformation associated with interception signaling control, i.e., the X2IRI information, is required. Alternatively, both the X2 IRI and the X3CC can be required and they can be associated with each other by abearer, i.e., each bearer is associated with the CC transmitted over thebearer. Accordingly, each of the contents reported to the LIG via the X2interface and via the X3 interface carries a feature value, such thatthe LIG can associate the reported X2 IRI with the reported X3 CC. Thisfeature value is assigned by interception devices (S-GW, PDN-GW andePDG) on a per bearer basis.

Currently, in a mobile network, intercepted targets are mainly networkelement devices in a core network device. For example, in an EPS, theintercepted targets defined in 3GPP protocols include a MobilityManagement Entity (MME), S-GW, PDN-GW, ePDG and Home Subscriber Server(HSS). Due to the path of data flow, the MME/HSS mainly provides IRI,such as a location of the intercepted target, some events (attachment,bearer activation and modification) associated with the interceptedtarget and a Quality of Service (QoS) of a bearer. The correspondinguser plane devices, such as S-GW, PDN-GW and ePDG can provide someintercepted user datagrams in addition to some IRI. However, in an LBOscenario, as traffic is offloaded at an eNodeB or a local gateway,without being delivered to the S-GW, PDN-GW or ePDG, it is currentlyimpossible to intercept any events associated with the interceptedtarget in the LBO scenario.

There are currently no effective solutions to the above problems.

BRIEF SUMMARY

The embodiments of the present disclosure provide a method and a devicefor interception based on LBO, capable of solving at least the problemin the related art that data of an interception target cannot beintercepted in an LBO scenario.

In an aspect of the embodiments of the present disclosure, a method forinterception based on LBO is provided. The method includes: receiving,by a small base station, an interception task instructing the small basestation to intercept an interception target; intercepting, by the smallbase station, LBO data of the interception target based on theinterception task to obtain intercepted data; and transmitting, by thesmall base station, the intercepted data.

Optionally, the interception task is transmitted by a core networkdevice and the small base station receiving the interception taskincludes: receiving, by the small base station, the interception taskgenerated by the core network device based on an interception requestfrom an interception gateway. The interception task carries a featurevalue generated by the core network device for each bearer of theinterception target for associating the intercepted data with thecorresponding bearer of the interception target.

Optionally, the small base station transmitting the intercepted dataincludes: establishing, by the small base station, an intercepted datatransmission channel for transmission of the intercepted data betweenthe small base station and the core network device; and transmitting, bythe small base station, the intercepted data to the core network devicevia the intercepted data transmission channel.

Optionally, the small base station transmitting the intercepted dataincludes: transmitting, by the small base station, uplink and downlinktraffic data of the interception target.

Optionally, the interception task is transmitted by an interceptionproxy to which the interception target belongs. The small base stationreceiving the interception task includes: receiving, by the small basestation, the interception task generated by the interception proxy towhich the interception target belongs based on an interception requestfrom an interception gateway. The small base station transmitting theintercepted data includes: transmitting, by the small base station, theintercepted data to the interception proxy, such that the interceptionproxy forwards the intercepted data.

Optionally, the intercepted data includes signaling data and trafficdata. The traffic data includes uplink and downlink traffic data of theinterception target. The signaling data includes at least one of: dataon attachment time of the interception target, data on geographicallocation of the interception target, data on a bearer used by theinterception target, a signaling message for the interception target.

Optionally, the interception task carries an address for storing theintercepted data and the small base station transmitting the intercepteddata includes: transmitting, by the small base station, the intercepteddata to the interception proxy, such that the interception proxyforwards the intercepted data to the address.

Optionally, the method further includes, subsequent to the small basestation receiving the interception task: assigning, by the small basestation, a feature value for each bearer of the interception target, forassociating the intercepted data with the corresponding bearer of theinterception target; and transmitting, by the small base station, theintercepted data carrying the feature value to the interception proxy.

In an aspect of the embodiments of the present disclosure, a device forinterception based on LBO is provided. The device includes: a receivingunit configured to receive an interception task instructing a small basestation to intercept an interception target; an intercepting unitconfigured to intercept LBO data of the interception target based on theinterception task to obtain intercepted data; and a transmitting unitconfigured to transmit the intercepted data.

Optionally, the interception task is transmitted by a core networkdevice and the receiving unit includes: a receiving module configured toreceive the interception task generated by the core network device basedon an interception request from an interception gateway. Theinterception task carries a feature value generated by the core networkdevice for each bearer of the interception target for associating theintercepted data with the corresponding bearer of the interceptiontarget.

Optionally, the transmitting unit includes: an establishing moduleconfigured to establish an intercepted data transmission channel fortransmission of the intercepted data between the small base station andthe core network device; and a transmitting module configured totransmit the intercepted data to the core network device via theintercepted data transmission channel.

Optionally, the transmitting unit is further configured to transmituplink and downlink traffic data of the interception target.

Optionally, the interception task is transmitted by an interceptionproxy to which the interception target belongs. The receiving unit isfurther configured to receive the interception task generated by theinterception proxy to which the interception target belongs based on aninterception request from an interception gateway. The transmitting unitis further configured to transmit the intercepted data to theinterception proxy, such that the interception proxy forwards theintercepted data.

Optionally, the intercepted data includes signaling data and trafficdata. The traffic data includes uplink and downlink traffic data of theinterception target. The signaling data includes at least one of: dataon attachment time of the interception target, data on geographicallocation of the interception target, data on a bearer used by theinterception target, a signaling message for the interception target.

Optionally, the interception task carries an address for storing theintercepted data and the transmitting unit is further configured totransmit the intercepted data to the interception proxy, such that theinterception proxy forwards the intercepted data to the address.

Optionally, the device further includes: an assigning unit configured toassign, after the small base station has received the interception task,a feature value for each bearer of the interception target, forassociating the intercepted data with the corresponding bearer of theinterception target; and a transmitting unit configured to transmit theintercepted data carrying the feature value to the interception proxy.

In yet another aspect of the embodiments of the present disclosure, anon-transitory computer readable storage medium is provided. Thenon-transitory computer readable storage medium stores computerinstructions causing a computer to perform the above method forinterception based on LBO according to the present disclosure.

In still another aspect of the embodiments of the present disclosure, acomputer program product is provided. The computer program productincludes a computer program stored on a non-transitory computer readablestorage medium. The computer program includes program instructionswhich, when executed by a computer, cause the computer to perform theabove method for interception based on LBO according to the presentdisclosure.

In a further aspect of the embodiments of the present disclosure, anelectronic device is provided. The electronic device includes at leastone processor and a memory connected communicatively to the at least oneprocessor. The memory stores instructions executable by the at least oneprocessor for performing the above method for interception based on LBOaccording to the present disclosure.

With the embodiments of the present disclosure, a small base stationreceives an interception task instructing the small base station tointercept an interception target. The small base station intercepts LBOdata of the interception target based on the interception task to obtainintercepted data. The small base station transmits the intercepted data.In this way, the small base station intercepts the LBO data in an LBOscenario to obtain the intercepted data, such that the problem in therelated art that data cannot be intercepted in an LBO scenario can besolved and an effect of intercepting data in the LBO scenario can beachieved.

BRIEF DESCRIPTION OF THE DRAWINGS

The figures described herein are provided for further understanding ofthe present disclosure, and constitute a part of the present disclosure.The illustrative embodiments of the present disclosure and thedescriptions thereof are for explaining the present disclosure, ratherthan unduly limiting the present disclosure. In the figures:

FIG. 1 is a schematic diagram showing a network deployment in an LBOscenario in the related art;

FIG. 2 is a schematic diagram showing an interception architecture inthe related art;

FIG. 3 is a flowchart illustrating a method for interception based onLBO according to an embodiment of the present disclosure;

FIG. 4 is a schematic diagram showing a network architecture in which aninterception task is transmitted by a core network device according toan embodiment of the present disclosure;

FIG. 5 is a schematic diagram showing interactions in a method for datainterception in which an interception task is transmitted by a corenetwork device according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram showing a network architecture in which aninterception task is transmitted by an interception proxy according toan embodiment of the present disclosure;

FIG. 7 is a schematic diagram showing interactions in a method for datainterception in which an interception task is transmitted by aninterception proxy according to an embodiment of the present disclosure;

FIG. 8 is a schematic diagram of a device for interception based on LBOaccording to an embodiment of the present disclosure; and

FIG. 9 is a schematic diagram showing a hardware structure of anelectronic device in which a method for interception based on LBO can beapplied according to an embodiment of the present disclosure.

DETAILED DESCRIPTION

In order to make those skilled in the art better understand the solutionof the present disclosure, the technical solutions in the embodiments ofthe present disclosure are clearly and completely described in thefollowing with reference to the accompanying drawings in the embodimentsof the present disclosure. It is apparent that the described embodimentsare only part of the embodiments of the present disclosure, but not allof them. All other embodiments obtained by those of ordinary skill inthe art based on the embodiments of the present disclosure without anycreative effort shall fall within the scope of protection of the presentdisclosure.

It should be noted that the terms “first,” “second,” and the like, inthe description and claims, as well as the above-mentioned drawings, ofthe present disclosure are used to distinguish similar objects, but notnecessarily used to describe a specific order or precedence order. Itshould be understood that data used in this way can be interchangedwhere appropriate so that the embodiments of the present disclosuredescribed herein can be implemented in a sequence other than thoseillustrated or described herein. The terms “including” and “having” andany variants thereof are intended to cover non-exclusive inclusions. Forexample, a process, method, system, product, or device that comprises aseries of steps or units is not necessarily limited to those steps orunits that are clearly listed, but may comprise other steps or unitsthat are not clearly listed or are inherent to such processes, methods,products, or devices.

According to the embodiment of the present disclosure, a method forinterception based on LBO is provided. It should be noted that the stepsshown in the flowchart of the accompanying drawings can be performed in,for example, a computer system of a group of computer executableinstructions. Besides, although a logical sequence is shown in theflowchart, in some cases, the steps shown or described can be performedin an order different from that described herein.

FIG. 3 is a flowchart illustrating a method for interception based onLBO according to an embodiment of the present disclosure. As shown inFIG. 3, the method includes the following steps.

At step S102, a small base station receives an interception taskinstructing the small base station to intercept an interception target.The interception task carries interception parameters, including anidentifier of the interception target, an IP address and a port numberof an X3 interface, and an IP address and a port number of an X2interface. Here, the identifier of the interception target can be anidentifier that uniquely identifies a UE, such as the UE's InternationalMobile Subscriber Identity (IMSI), Mobile Subscriber ISDN Number(MSISDN), International Mobile station Equipment Identity (IMEI),Network Access Identity (NAI) or IP address.

At step S104, the small base station intercepts LBO data of theinterception target based on the interception task to obtain intercepteddata. In an LBO scenario, data traffic can bypass a core network deviceand be offloaded from the small base station directly to the Internet,without being delivered to S-GW, PDN-GW or ePDG. Hence, the LBO data ofthe interception target can be intercepted at the small location toobtain the intercepted data.

At step S106, the small base station transmits the intercepted data. Thesmall base station can transmit the intercepted data to a default objectfor processing the intercepted data, e.g., an interception gateway, orto an address carried in the interception task.

In the LBO scenario, data traffic is directly offloaded from the smallbase station, such that the offloaded traffic cannot be intercepted in aconventional way. With the above embodiment, by intercepting the LBOdata at the small base station, the intercepted data can be obtained. Inthis way, the problem in the related art that data cannot be interceptedin the LBO scenario can be solved, thereby achieving an effect ofintercepting data in the LBO scenario.

Optionally, the interception task is transmitted by a core networkdevice or an interception proxy to which the interception targetbelongs. An interception gateway can transmit the interception task tothe core network device or the interception proxy to which theinterception target belongs. After receiving the interception task, thecore network device transmits it to the small base station. If theinterception gateway transmits the interception task to the interceptionproxy, the interception proxy will forward it to the small base station.

The interception proxy may manage small base stations within an area,transmit the interception task to the small base station within the areait manages, and forward the intercepted data to the interceptiongateway. The interception proxy can be deployed anywhere and preferablyat a core network device (trusted domain). When compared with the schemein which the core network device transmits the interception task and theintercepted data, the scheme in which the interception proxy forwardsthe interception task and the intercepted data may save resources at thecore network device and require less modification to the core networkdevice.

In the following, the schemes in which the core network device and theinterception proxy transmit the interception task and report theintercepted data will be explained respectively.

(1) The core network device transmits the interception task.

As shown in FIG. 4, a terminal transmits traffic data via a small basestation in an LBO scenario. It can be seen from FIG. 4 that the data ofthe terminal is transmitted directly via the small base station withoutpassing through the core network. Hence, the small base station canintercept the LBO data.

-   -   (1) The interception gateway notifies the core network device to        intercept the interception target. The notification carries an        identifier of the interception target.    -   (2) The core network device transmits an interception task to        the small base station. The core network device determines        whether the interception target is a UE in an LBO scenario by        means of UE identifier matching. If so, the core network device        transmits an interception task to the small base station; or        otherwise it performs the interception itself. Here, the core        network device assigns a feature value (correlation number) for        each bearer of the interception target, for associating the        intercepted data with the corresponding bearer of the        interception target. The core network device generates the        interception task from formation including the generated feature        value and the identifier of the interception target for        transmitting to the small base station. Meanwhile, the core        network device also generates a response message for reporting        to the interception gateway.    -   (3) The small base station intercepts the interception target        based on the interception task and transmits the intercepted        data to the core network device. The small base station        establishes a dedicated transmission channel with the core        network device for transmission of the data intercepted by the        small base station. The base station intercepts the LBO data of        the interception target and transmits the intercepted data via        the dedicated transmission channel.    -   (4) The core network device forwards the intercepted device to        the interception gateway. In addition to the intercepted data,        the core network device can also transmit a signaling message to        the interception gateway, e.g., to notify the interception        gateway that the interception has begun, continued or ended.

The following description will be given with reference to theinteractions shown in FIG. 5.

At S501, the interception gateway transmits a message to the corenetwork device via an X1 interface, notifying the core network device tointercept the interception target NAI01.

At S502, the core network device determines whether the interceptiontarget NAI01 transmits traffic data in an LBO mode. If so, it transmitsan interception task to the small base station. The core network deviceparses the message transmitted from the interception gateway to obtaininterception parameters, including an identifier NAI01 of theinterception target, an IP address of an X2 interface IPX2, and an IPaddress of an X3 interface IPX3. The core network device learns that theinterception target NAI01 has four bearers and assigns a feature valueto each of the bearers, i.e., CZ1, CZ2, CZ3 and CZ4.

The core network device transmits the identifier NAI01 of theinterception target, the respective feature values of the four bearers,CZ1, CZ2, CZ3 and CZ4, to the small base station.

Meanwhile, the core network device generates a signaling message, e.g.,X2 IRI_BEGIN, for reporting that the interception for NAI01 has begun.

At S503, the small base station receives the interception tasktransmitted from the core network device and establishes a dedicatedtransmission channel with the core network device for transmitting theintercepted data obtained by intercepting NAI01 to the core networkdevice. For example, there may be a video data transmission between theinterception target NAI01 and Terminal B. The uplink and downlink videodata for the interception target NAI01 can be intercepted in the LBOscenario. The small base station intercepts data over each bearer of theinterception target and adds the corresponding feature value to theintercepted data for each bearer. When the video data is interceptedover the four bearers, the intercepted data transmitted to the corenetwork device can include: Video Data 1_CZ1_NAI01, Video Data2_CZ2_NAI01, Video Data 3_CZ3_NAI01 and Video Data 4_CZ4_NAI01. When abearer is added or modified, the feature value of the correspondingbearer changes, so as to keep track of the intercepted data.

At S504, the core network device receives the intercepted data,encapsulates the received video data in a message format defined for theX3 interface and encapsulates a signaling message in a message formatdefined for the X2 interface. The signaling message may include: ageographical location of the interception target NAI01 (the location isreported to the interception gateway each time it moves from one basestation to another), time at which the interception target NAI01 beginsto transmit chatting data, time at which the interception target NAI01stops transmitting the chatting data, information on bandwidth fortransmission of the video data between the interception target NAI01 andTerminal B (the number of bearers used for transmission of the chattingdata between the interception target NAI01 and Terminal B, each bearerhaving QoS properties including bandwidth information). The signalingmessage may carry the feature value of each bearer, e.g., a signalingmessage X2 IRI_Begintime10:00_CZ2_NAI01 for notifying the interceptiongateway of the time at which NAI01 begins to transmit the chatting data,or a signaling message indicating that the interception has continued orended.

At S505, the core network device transmits the intercepted data and thesignaling message to the interception gateway. It is to be noted thatthe specific formats of the intercepted data and signaling message areonly for the purpose of illustrating what data is transmitted by thecore network device and what content is carried by the transmitted data.This embodiment is not limited to those formats. Any messagesencapsulated in any format defined for the X2 and X3 interfaces can beused in this embodiment.

With the above embodiment, the small base station intercepts theinterception target based on the interception task transmitted by thecore network and transmits the intercepted data to the core network forforwarding to the interception gateway. In this way, the interceptiontarget can be intercepted in the LBO mode, such that the problem in therelated art that the interception target cannot be intercepted in theLBO mode can be solved. Furthermore, each bearer of the small basestation corresponds to a feature value which is transmitted to theinterception gateway along with the intercepted data, such that theinterception gateway can analyze the intercepted data for each bearer.

(2) The interception proxy transmits the interception task.

As shown in FIG. 6, the interception gateway transmits to theinterception proxy a notification to intercept the interception targetand the interception proxy transmits the interception task to the smallbase station. After the small base station has intercepted data, theinterception proxy forwards the intercepted data. The interception proxyis preferably, but not limited to be, located in the core networkdevice. When compared with the scheme in which the core network deviceforwards the intercepted data, the scheme in which the interceptionproxy forwards the data may save resources at the core network device.In this way, the core network device may focus on its communicationfunctions, without allocating excessive resources for the interception,which has less modifications to the core network device and thefunctions thereof.

-   -   (1) The interception gateway requests a Home Subscriber Server        (HSS) to inquire about the interception proxy to which the        interception target belongs. The interception proxy can transmit        an interception task for at least one interception target.    -   (2) The HSS returns an identifier of the interception proxy to        which the interception target belongs to the interception        gateway. The identifier can be an IP address or domain name of        the interception proxy.    -   (3) After obtaining the identifier of the interception proxy,        the interception gateway transmits to the corresponding        interception proxy a notification to monitor the interception        target, notifying the interception proxy to intercept the        interception target. The notification may carry interception        parameters, including an identifier of the interception target,        an IP address and a port number of an X2 interface, and an IP        address and a port number of an X3 interface.    -   (4) The interception proxy generates an interception task which        may carry the identifier of the interception target and an        address and port number of the interception proxy. The        interception proxy transmits the interception task to a small        base station it manages.    -   (5) The small base station receives the interception task        generated by the interception to which the interception target        belongs based on the interception request from the interception        gateway. The small base station intercepts the interception        target based on the identifier of the interception target        carried in the interception task, and transmits the intercepted        data to the interception proxy.

Upon receiving the interception task, the small base station obtains theidentifier of the interception target. The identifier of theinterception target can be an identifier that uniquely identifies a UE,such as the UE's International Mobile Subscriber Identity (IMSI), MobileSubscriber ISDN Number (MSISDN), International Mobile station EquipmentIdentity (IMEI), Network Access Identity (NAI) or IP address.Alternatively, it can be an identifier regenerated by the interceptionproxy and recognizable by the small base station. The small base stationassigns a feature value for each bearer of the interception target andtransmits the feature value along with the intercepted data. The featurevalue is used for associating the intercepted data with thecorresponding bearer of the interception target. The small base stationcan transmit signaling data and traffic data to the interception proxy.The traffic data may include uplink and downlink traffic data of theinterception target and the signaling data may include at least one of:data on attachment time of the interception target, data on geographicallocation of the interception target, data on a bearer used by theinterception target, a signaling message for the interception target.

The signaling data can be encapsulated in a format defined for the X2interface for transmission to the interception proxy. The traffic datacan be encapsulated in a format defined for the X3 interface. When thetraffic data is transmitted, a corresponding feature value is added tothe data transmitted over each bearer.

-   -   (6) The interception proxy forwards the intercepted data        transmitted from the base station to the interception gateway or        to an address which the interception gateway instructs the        interception proxy to transmit the intercepted data to.

This embodiment will be explained with reference to the interactionsshown in FIG. 7.

At S701, the interception gateway transmits a request to the HSS forinquiring about the interception proxy to which the interception targetNAI01 belongs.

At S702, the HSS transmits an identifier, P01, of the interception proxyto the interception gateway.

At S703, the interception gateway transmits to the interception proxyP01 an interception notification carrying the identifier NAI01 of theinterception target. The notification may further carry an IP addressand a port number of an X2 interface, and an IP address and a portnumber of an X3 interface.

At S704, the interception proxy generates an interception task andtransmits the interception carrying the identifier NAI01 of theinterception target to the small base station. That is, the interceptiongateway transmits an inquiry request to the HSS for inquiring theinterception proxy to which the interception target NAI01 belongs. Theinterception gateway receives the interception proxy and transmits aninterception request to the interception proxy, such that theinterception proxy can generate the interception task based on theinterception request.

At S705, the small base station transmits the intercepted data to theinterception proxy. The small base station can obtain from theinterception task the identifier NAI01 of the interception target andthe identifier of the interception proxy P01 (or the IP address and portnumber of the interception proxy). The small base station generates afeature value for each bearer of the interception target NAI01 andintercepts uplink/downlink data of the interception target NAI01. Forexample, there may be a video data transmission between the interceptiontarget NAI01 and Terminal B. The uplink and downlink video data for theinterception target NAI01 can be intercepted in the LBO scenario. Thesmall base station intercepts data over each bearer of the interceptiontarget and adds the corresponding feature value to the intercepted datafor each bearer. When the video data is intercepted over the fourbearers, the intercepted data transmitted to the interception proxy caninclude: Video Data 1_CZ1_NAI01, Video Data 2_CZ2_NAI01, Video Data3_CZ3_NAI01 and Video Data 4_CZ4_NAI01.

The small base station encapsulates the received video data in a messageformat defined for the X3 interface and encapsulates a signaling messagein a message format defined for the X2 interface. The signaling messagemay include: a geographical location of the interception target NAI01(the location is reported to the interception gateway each time it movesfrom one base station to another), time at which the interception targetNAI01 begins to transmit chatting data, time at which the interceptiontarget NAI01 stops transmitting the chatting data, information onbandwidth for transmission of the video data between the interceptiontarget NAI01 and Terminal B (the number of bearers used for transmissionof the chatting data between the interception target NAI01 and TerminalB, each bearer having QoS properties including bandwidth information).The signaling message may carry the feature value of each bearer, e.g.,a signaling message X2 IRI_Begintime10:00 CZ2_NAI01 for notifying theinterception gateway of the time at which NAI01 begins to transmit thechatting data, or a signaling message indicating that the interceptionhas continued or ended. It is to be noted that the specific formats ofthe intercepted data and signaling message are only for the purpose ofillustrating what data is transmitted by the small base station and whatcontent is carried by the transmitted data. This embodiment is notlimited to those formats. Any messages encapsulated in any formatdefined for the X2 and X3 interfaces can be used in this embodiment.When the data is encapsulated, bearer information can be carried andadditional information such as a timestamp can also be carried, suchthat data analysis can be applied to the intercepted data.

At S706, the interception proxy forwards the intercepted data to theinterception gateway. The interception proxy can forward the intercepteddata transmitted from the small base station to the interceptiongateway. The interception proxy can transmit the intercepted data basedon the interface address and port number in the notification transmittedfrom the interception gateway.

When a bearer is added or modified, the feature value of thecorresponding bearer changes accordingly. The small base station cangenerate a new features value for a new bearer, so as to keep track ofthe intercepted data. The other steps are the same as those describedabove and details thereof will be omitted here.

With the above embodiment, the interception target can be intercepted inthe LBO scenario. The small base station intercepts the uplink anddownlink data over each bearer of the interception target and transmitsthe signaling message to the interception gateway, notifying theinterception gateway that the current interception has begun, continuedor ended. With the interception proxy forwarding the intercepted dataand transmitting the interception task, resources used by the corenetwork device in the interception process can be reduced and excessivemodifications and settings for the core network device can be avoided.

It is to be noted that the wireless communication technologies describedin the embodiments of the present disclosure can include, but notlimited to, WCDMA, CDMA2000, TD-SCDMA, WiMAX, LTE/LTE-A and the 5^(th),6^(th), . . . , N-th generations of mobile communication technologies inthe future, or wireless communication technologies such as WiFi,BlueTooth or infrared. For the purpose of simplicity, the embodiments ofthe present disclosure are described with reference to the 4^(th)generation of mobile communication technologies such as LTE/LTE-A forexample. In this case, the interception target can be a mobilecommunication terminal and the small base station is a representative ofaccess devices.

According to an embodiment of the present disclosure, a device forinterception based on LBO is provided. As shown in FIG. 8, the devicefor interception based on LBO includes a receiving unit 10, anintercepting unit 20 and a transmitting unit 30.

The receiving unit 10 is configured to receive an interception taskinstructing a small base station to intercept an interception target.The interception task carries interception parameters, including anidentifier of the interception target, an IP address and a port numberof an X3 interface, and an IP address and a port number of an X2interface. Here, the identifier of the interception target can be anidentifier that uniquely identifies a UE, such as the UE's InternationalMobile Subscriber Identity (IMSI), Mobile Subscriber ISDN Number(MSISDN), International Mobile station Equipment Identity (IMEI),Network Access Identity (NAI) or IP address.

The intercepting unit 20 is configured to intercept LBO data of theinterception target based on the interception task to obtain intercepteddata. In an LBO scenario, data traffic can bypass a core network deviceand be offloaded from the small base station directly to the Internet,without being delivered to S-GW, PDN-GW or ePDG. Hence, the LBO data ofthe interception target can be intercepted at the small location toobtain the intercepted data.

The transmitting unit 30 is configured to transmit the intercepted data.The small base station can transmit the intercepted data to a defaultobject for processing the intercepted data, e.g., an interceptiongateway, or to an address carried in the interception task.

In the LBO scenario, data traffic is directly offloaded from the smallbase station, such that the offloaded traffic cannot be intercepted in aconventional way. With the above embodiment, by intercepting the LBOdata at the small base station, the intercepted data can be obtained. Inthis way, the problem in the related art that data cannot be interceptedin the LBO scenario can be solved, thereby achieving an effect ofintercepting data in the LBO scenario.

Optionally, the interception task is transmitted by a core networkdevice and the receiving unit includes: a receiving module configured toreceive the interception task generated by the core network device basedon an interception request from an interception gateway. Theinterception task carries a feature value generated by the core networkdevice for each bearer of the interception target for associating theintercepted data with the corresponding bearer of the interceptiontarget.

The interception proxy may manage small base stations within an area,transmit the interception task to the small base station within the areait manages, and forward the intercepted data to the interceptiongateway. The interception proxy can be deployed anywhere and preferablyat a core network device (trusted domain). When compared with the schemein which the core network device transmits the interception task and theintercepted data, the scheme in which the interception proxy forwardsthe interception task and the intercepted data may save resources at thecore network device and require less modifications to the core networkdevice.

In the following, the schemes in which the core network device and theinterception proxy transmit the interception task and report theintercepted data will be explained respectively.

(1) The core network device transmits the interception task.

As shown in FIG. 4, a terminal transmits traffic data via a small basestation in an LBO scenario. It can be seen from FIG. 4 that the data ofthe terminal is transmitted directly via the small base station withoutpassing through the core network. Hence, the small base station canintercept the LBO data.

The core network device forwards the intercepted device to theinterception gateway. In addition to the intercepted data, the corenetwork device can also transmit a signaling message to the interceptiongateway, e.g., to notify the interception gateway that the interceptionhas begun, continued or ended.

Optionally, the transmitting unit includes: an establishing moduleconfigured to establish an intercepted data transmission channel fortransmission of the intercepted data between the small base station andthe core network device; and a transmitting module configured totransmit the intercepted data to the core network device via theintercepted data transmission channel.

Optionally, the transmitting unit is further configured to transmituplink and downlink traffic data of the interception target.

The following description will be given with reference to theinteractions shown in FIG. 5.

At S501, the interception gateway transmits a message to the corenetwork device via an X1 interface, notifying the core network device tointercept the interception target NAI01.

At S502, the core network device determines whether the interceptiontarget NAI01 transmits traffic data in an LBO mode. If so, it transmitsan interception task to the small base station. The core network deviceparses the message transmitted from the interception gateway to obtaininterception parameters, including an identifier NAI01 of theinterception target, an IP address of an X2 interface IPX2, and an IPaddress of an X3 interface IPX3. The core network device learns that theinterception target NAI01 has four bearers and assigns a feature valueto each of the bearers, i.e., CZ1, CZ2, CZ3 and CZ4.

The core network device transmits the identifier NAI01 of theinterception target, the respective feature values of the four bearers,CZ1, CZ2, CZ3 and CZ4, to the small base station.

Meanwhile, the core network device generates a signaling message, e.g.,X2 IRI_BEGIN, for reporting that the interception for NAI01 has begun.

At S503, the small base station receives the interception tasktransmitted from the core network device and establishes a dedicatedtransmission channel with the core network device for transmitting theintercepted data obtained by intercepting NAI01 to the core networkdevice. For example, there may be a video data transmission between theinterception target NAI01 and Terminal B. The uplink and downlink videodata for the interception target NAI01 can be intercepted in the LBOscenario. The small base station intercepts data over each bearer of theinterception target and adds the corresponding feature value to theintercepted data for each bearer. When the video data is interceptedover the four bearers, the intercepted data transmitted to the corenetwork device can include: Video Data 1_CZ1_NAI01, Video Data2_CZ2_NAI01, Video Data 3_CZ3_NAI01 and Video Data 4_CZ4_NAI01. When abearer is added or modified, the feature value of the correspondingbearer changes, so as to keep track of the intercepted data.

At S504, the core network device receives the intercepted data,encapsulates the received video data in a message format defined for theX3 interface and encapsulates a signaling message in a message formatdefined for the X2 interface. The signaling message may include: ageographical location of the interception target NAI01 (the location isreported to the interception gateway each time it moves from one basestation to another), time at which the interception target NAI01 beginsto transmit chatting data, time at which the interception target NAI01stops transmitting the chatting data, information on bandwidth fortransmission of the video data between the interception target NAI01 andTerminal B (the number of bearers used for transmission of the chattingdata between the interception target NAI01 and Terminal B, each bearerhaving QoS properties including bandwidth information). The signalingmessage may carry the feature value of each bearer, e.g., a signalingmessage X2 IRI_Begintime10:00_CZ2_NAI01 for notifying the interceptiongateway of the time at which NAI01 begins to transmit the chatting data,or a signaling message indicating that the interception has continued orended.

At S505, the core network device transmits the intercepted data and thesignaling message to the interception gateway. It is to be noted thatthe specific formats of the intercepted data and signaling message areonly for the purpose of illustrating what data is transmitted by thecore network device and what content is carried by the transmitted data.This embodiment is not limited to those formats. Any messagesencapsulated in any format defined for the X2 and X3 interfaces can beused in this embodiment.

With the above embodiment, the small base station intercepts theinterception target based on the interception task transmitted by thecore network and transmits the intercepted data to the core network forforwarding to the interception gateway. In this way, the interceptiontarget can be intercepted in the LBO mode, such that the problem in therelated art that the interception target cannot be intercepted in theLBO mode can be solved. Furthermore, each bearer of the small basestation corresponds to a feature value which is transmitted to theinterception gateway along with the intercepted data, such that theinterception gateway can analyze the intercepted data for each bearer.

(2) The interception proxy transmits the interception task.

As shown in FIG. 6, the interception gateway transmits to theinterception proxy a notification to intercept the interception targetand the interception proxy transmits the interception task to the smallbase station. After the small base station has intercepted data, theinterception proxy forwards the intercepted data. The interception proxyis preferably, but not limited to be, located in the core networkdevice. When compared with the scheme in which the core network deviceforwards the intercepted data, the scheme in which the interceptionproxy forwards the data may save resources at the core network device.In this way, the core network device may focus on its communicationfunctions, without allocating excessive resources for the interception,which has less modifications to the core network device and thefunctions thereof.

Optionally, the interception task is transmitted by an interceptionproxy to which the interception target belongs. The receiving unit isfurther configured to receive the interception task generated by theinterception proxy to which the interception target belongs based on aninterception request from an interception gateway. The transmitting unitis further configured to transmit the intercepted data to theinterception proxy, such that the interception proxy can forward theintercepted data.

Optionally, the intercepted data includes signaling data and trafficdata. The traffic data includes uplink and downlink traffic data of theinterception target. The signaling data includes at least one of: dataon attachment time of the interception target, data on geographicallocation of the interception target, data on a bearer used by theinterception target, a signaling message for the interception target.

Optionally, the interception task carries an address for storing theintercepted data and the transmitting unit is further configured totransmit the intercepted data to the interception proxy, such that theinterception proxy can forward the intercepted data to the address.

Optionally, the device further includes: an assigning unit configured toassign, after the small base station has received the interception task,a feature value for each bearer of the interception target, forassociating the intercepted data with the corresponding bearer of theinterception target; and a transmitting unit configured to transmit theintercepted data carrying the feature value to the interception proxy.

This embodiment will be explained with reference to the interactionsshown in FIG. 7.

At S701, the interception gateway transmits a request to the HSS forinquiring about the interception proxy to which the interception targetNAI01 belongs.

At S702, the HSS transmits an identifier, P01, of the interception proxyto the interception gateway.

At S703, the interception gateway transmits to the interception proxyP01 an interception notification carrying the identifier NAI01 of theinterception target. The notification may further carry an IP addressand a port number of an X2 interface, and an IP address and a portnumber of an X3 interface.

At S704, the interception proxy generates an interception task andtransmits the interception carrying the identifier NAI01 of theinterception target to the small base station. That is, the interceptiongateway transmits an inquiry request to the HSS for inquiring theinterception proxy to which the interception target NAI01 belongs. Theinterception gateway receives the interception proxy and transmits aninterception request to the interception proxy, such that theinterception proxy can generate the interception task based on theinterception request.

At S705, the small base station transmits the intercepted data to theinterception proxy. The small base station can obtain from theinterception task the identifier NAI01 of the interception target andthe identifier P01 of the interception proxy (or the IP address and portnumber of the interception proxy). The small base station generates afeature value for each bearer of the interception target NAI01 andintercepts uplink/downlink data of the interception target NAI01. Forexample, there may be a video data transmission between the interceptiontarget NAI01 and Terminal B. The uplink and downlink video data for theinterception target NAI01 can be intercepted in the LBO scenario. Thesmall base station intercepts data over each bearer of the interceptiontarget and adds the corresponding feature value to the intercepted datafor each bearer. When the video data is intercepted over the fourbearers, the intercepted data transmitted to the interception proxy caninclude: Video Data 1_CZ1_NAI01, Video Data 2_CZ2_NAI01, Video Data3_CZ3_NAI01 and Video Data 4_CZ4_NAI01.

The small base station encapsulates the received video data in a messageformat defined for the X3 interface and encapsulates a signaling messagein a message format defined for the X2 interface. The signaling messagemay include: a geographical location of the interception target NAI01(the location is reported to the interception gateway each time it movesfrom one base station to another), time at which the interception targetNAI01 begins to transmit chatting data, time at which the interceptiontarget NAI01 stops transmitting the chatting data, information onbandwidth for transmission of the video data between the interceptiontarget NAI01 and Terminal B (the number of bearers used for transmissionof the chatting data between the interception target NAI01 and TerminalB, each bearer having QoS properties including bandwidth information).The signaling message may carry the feature value of each bearer, e.g.,a signaling message X2 IRI_Begintime10:00_CZ2_NAI01 for notifying theinterception gateway of the time at which NAI01 begins to transmit thechatting data, or a signaling message indicating that the interceptionhas continued or ended. It is to be noted that the specific formats ofthe intercepted data and signaling message are only for the purpose ofillustrating what data is transmitted by the small base station and whatcontent is carried by the transmitted data. This embodiment is notlimited to those formats. Any messages encapsulated in any formatdefined for the X2 and X3 interfaces can be used in this embodiment.When the data is encapsulated, bearer information can be carried andadditional information such as a timestamp can also be carried, suchthat data analysis can be applied to the intercepted data.

At S706, the interception proxy forwards the intercepted data to theinterception gateway. The interception proxy can forward the intercepteddata transmitted from the small base station to the interceptiongateway. The interception proxy can transmit the intercepted data basedon the interface address and port number in the notification transmittedfrom the interception gateway.

When a bearer is added or modified, the feature value of thecorresponding bearer changes accordingly. The small base station cangenerate a new features value for a new bearer, so as to keep track ofthe intercepted data. The other steps are the same as those describedabove and details thereof will be omitted here.

With the above embodiment, the interception target can be intercepted inthe LBO scenario. The small base station intercepts the uplink anddownlink data over each bearer of the interception target and transmitsthe signaling message to the interception gateway, notifying theinterception gateway that the current interception has begun, continuedor ended. With the interception proxy forwarding the intercepted dataand transmitting the interception task, resources used by the corenetwork device in the interception process can be reduced and excessivemodifications and settings for the core network device can be avoided.

According to an embodiment, a non-transitory computer readable storagemedium is also provided. The non-transitory computer readable storagemedium stores computer instructions causing a computer to execute themethod according to any of the above method embodiments of the presentdisclosure.

According to an embodiment, a computer program product is also provided.The computer program product includes a computer program stored on anon-transitory computer readable storage medium. The computer programincludes program instructions which, when executed by a computer, causethe computer to execute the method according to any of the above methodembodiments of the present disclosure.

FIG. 9 is a schematic diagram showing a hardware structure of anelectronic device that performs the method for interception based on LBOaccording to an embodiment. As shown in FIG. 9, the electronic deviceincludes one or more processors 41 and a memory 42. FIG. 9 illustratesone processor 41 as an example.

The electronic device can further include an input device 43 and anoutput device 44.

The processor 41, the memory 42, the input device 43 and the outputdevice 44 can be connected via a bus or by other means. FIG. 9illustrates a bus connection as an example.

As a non-transitory computer readable storage medium, the memory 42 canbe configured to store a non-transitory software program, anon-transitory computer executable program and modules, for example,program instructions/modules (for example, the receiving unit 10,intercepting unit 20 and transmitting unit 30 as shown in FIG. 8)corresponding to the method for interception based on LBO in theembodiment of the present disclosure. The processor 41 executes variousfunctional applications and data processing of a server through runningof the non-transitory software program, instruction and module stored inthe memory 42. In this way, the method for interception based on LBO inthe above embodiment can be executed.

The memory 42 can include a program memory area and a data memory area.The program memory area can store an operating system and an applicationprogram required by at least one function. The data memory area canstore data that are created in accordance with application of the devicefor interception based on LBO. Moreover, the memory 42 can include ahigh-speed random access memory, and can further include anon-transitory memory, such as at least one disk memory, a flash memoryor other non-transitory solid-state memories. In some embodiments, thememory 42 can include memories which are remotely disposed relative tothe processor 41. These remote memories can be connected to the devicefor interception based on LBO through networks which include but notlimited to Internet, Intranet, local area network, mobile radiocommunications and a combination thereof.

The input device 43 can receive input digital or character informationand generate key signal inputs relevant to user settings and functionalcontrol of the device for interception based on LBO. The output device44 can include a display device such as a display screen.

The one or more modules are stored in the memory 42. The modules, whenexecuted by one or more processors 41, perform the method forinterception based on LBO in any of the above method embodiments.

The above product can execute the method provided by the embodiment ofthe present disclosure and have corresponding functional modules andbeneficial effects for executing the method. For the technical detailsnot described in the present embodiment, reference can be made to themethod provided by the embodiment of the present disclosure.

The electronic device provided by the embodiment of the presentdisclosure can be embodied in various forms, including but not limitedto the following:

-   -   (1) Mobile communication equipment: those having the feature of        a mobile communication function and the main object of providing        voice and data communication, and including a smart phone (e.g.,        iPhone), a multimedia mobile phone, a functional mobile phone, a        low-end mobile phone, etc.    -   (2) Ultra-mobile personal computer equipment: those belonging to        personal computers, having computing and processing functions,        generally having a mobile Internet access feature and including        PDAs, MIDs, UMPCs, etc., for example, iPads.    -   (3) Portable recreation equipment: those being capable of        displaying and broadcasting multimedia contents and including        audio and video players (e.g., iPods), a hand-held game player,        an e-book, intelligent toys and portable vehicle-mounted        navigation equipment.    -   (4) Servers: those providing computing service and including a        processor, a hard disk, an internal memory, a system bus, etc.,        having a similar architecture to a universal computer and        placing higher demands on the processing capability, the        stability, the reliability, the security, the expandability, the        manageability, etc., due to the need for providing        high-reliability services.    -   (5) Other electronic devices with data interaction functions.

The serial numbers of the embodiments of the present disclosure aremerely for description, and do not represent the advantages anddisadvantages of the embodiments.

In the above-mentioned embodiments of the present disclosure, thedescriptions of the embodiments have their respective emphases. For theparts that are not detailed in a certain embodiment, reference can bemade to the related descriptions of other embodiments.

It should be understood that in the embodiments provided by the presentdisclosure, the disclosed technical contents can be achieved by othermeans. The device embodiments described above are merely schematic. Forexample, the partitioning of the units can be a logical functionalpartitioning. There may be other partitioning modes during actualimplementation. For example, multiple units or components can becombined or integrated into another system, or some features can beignored or not executed. In addition, mutual coupling or direct couplingor communication connection that is shown or discussed can be indirectcoupling or communication connection through some interfaces, units ormodules, and can be in electrical or other forms.

The units described as separate components may or may not be physicallyseparated, and the components for unit display may or may not bephysical units, that is, may be located in one place or distributed on aplurality of units. Part or all of the units can be selected accordingto actual needs to achieve the object of the solutions of theembodiments.

In addition, all functional units in the embodiments of the presentdisclosure can be integrated into one processing unit. Or, each unitexists physically independently. Or, two or more units can be integratedinto one unit. The above integrated units can be embodied in the form ofhardware or a software functional unit.

The integrated units, if embodied in the form of the software functionalunit and sold or used as a standalone product, can be stored in acomputer readable storage medium. Based on such understanding, thetechnical solution of the present disclosure in essence, or a part thatcontributes to the related art, or all or part of the technicalsolution, can be embodied in the form of a software product. Thecomputer software product is stored in a storage medium and includes aplurality of instructions for a computer device (which can be a personalcomputer, a server, a network device or the like) to perform all or partof the steps of the method described in the embodiments of the presentdisclosure. The foregoing storage medium includes: a USB flash disk, aRead-Only Memory (ROM), a Random Access Memory (RAM), a removable harddisk, a magnetic disk, an optical disk, or other various media that canstore program codes.

The above description merely describes preferable implementations of thepresent disclosure, and it should be noted that those skilled in the artcan also make various improvements and modifications without departingfrom the principle of the present disclosure. These improvements andmodifications should be considered to be within the scope of protectionof the present disclosure.

1. A method for interception based on Local Break Out (LBO), comprising:receiving, by a small base station, an interception task instructing thesmall base station to intercept an interception target; intercepting, bythe small base station, LBO data of the interception target based on theinterception task to obtain intercepted data; and transmitting, by thesmall base station, the intercepted data.
 2. The method of claim 1,wherein the interception task is transmitted by a core network device,and the small base station receiving the interception task comprises:receiving, by the small base station, the interception task generated bythe core network device based on an interception request from aninterception gateway, wherein the interception task carries a featurevalue generated by the core network device for each bearer of theinterception target for associating the intercepted data with thecorresponding bearer of the interception target.
 3. The method of claim2, wherein the small base station transmitting the intercepted datacomprises: establishing, by the small base station, an intercepted datatransmission channel for transmission of the intercepted data betweenthe small base station and the core network device; and transmitting, bythe small base station, the intercepted data to the core network devicevia the intercepted data transmission channel.
 4. The method of claim 1,wherein the small base station transmitting the intercepted datacomprises: transmitting, by the small base station, uplink and downlinktraffic data of the interception target.
 5. The method of claim 1,wherein the interception task is transmitted by an interception proxy towhich the interception target belongs, the small base station receivingthe interception task comprises: receiving, by the small base station,the interception task generated by the interception proxy to which theinterception target belongs based on an interception request from aninterception gateway, and the small base station transmitting theintercepted data comprises: transmitting, by the small base station, theintercepted data to the interception proxy, such that the interceptionproxy forwards the intercepted data.
 6. The method of claim 5, whereinthe intercepted data comprises signaling data and traffic data, thetraffic data comprising uplink and downlink traffic data of theinterception target and the signaling data comprising at least one of:data on attachment time of the interception target, data on geographicallocation of the interception target, data on a bearer used by theinterception target, a signaling message for the interception target. 7.The method of claim 5, wherein the interception task carries an addressfor storing the intercepted data and the small base station transmittingthe intercepted data comprises: transmitting, by the small base station,the intercepted data to the interception proxy, such that theinterception proxy forwards the intercepted data to the address.
 8. Themethod of claim 5, further comprising, subsequent to the small basestation receiving the interception task: assigning, by the small basestation, a feature value for each bearer of the interception target, forassociating the intercepted data with the corresponding bearer of theinterception target; and transmitting, by the small base station, theintercepted data carrying the feature value to the interception proxy.9. A device for interception based on Local Break Out (LBO), comprising:a receiving unit configured to receive an interception task instructinga small base station to intercept an interception target; anintercepting unit configured to intercept LBO data of the interceptiontarget based on the interception task to obtain intercepted data; and atransmitting unit configured to transmit the intercepted data.
 10. Thedevice of claim 9, wherein the interception task is transmitted by acore network device, and the receiving unit comprises: a receivingmodule configured to receive the interception task generated by the corenetwork device based on an interception request from an interceptiongateway, wherein the interception task carries a feature value generatedby the core network device for each bearer of the interception targetfor associating the intercepted data with the corresponding bearer ofthe interception target.
 11. The device of claim 10, wherein thetransmitting unit comprises: an establishing module configured toestablish an intercepted data transmission channel for transmission ofthe intercepted data between the small base station and the core networkdevice; and a transmitting module configured to transmit the intercepteddata to the core network device via the intercepted data transmissionchannel.
 12. The device of claim 9, wherein the transmitting unit isfurther configured to transmit uplink and downlink traffic data of theinterception target.
 13. The device of claim 9, wherein the interceptiontask is transmitted by an interception proxy to which the interceptiontarget belongs, the receiving unit is further configured to receive theinterception task generated by the interception proxy to which theinterception target belongs based on an interception request from aninterception gateway, and the transmitting unit is further configured totransmit the intercepted data to the interception proxy, such that theinterception proxy forwards the intercepted data.
 14. The device ofclaim 13, wherein the intercepted data comprises signaling data andtraffic data, the traffic data comprising uplink and downlink trafficdata of the interception target and the signaling data comprising atleast one of: data on attachment time of the interception target, dataon geographical location of the interception target, data on a bearerused by the interception target, a signaling message for theinterception target.
 15. The device of claim 13, wherein theinterception task carries an address for storing the intercepted dataand the transmitting unit is further configured to transmit theintercepted data to the interception proxy, such that the interceptionproxy forwards the intercepted data to the address.
 16. The device ofclaim 13, further comprising: an assigning unit configured to assign,after the small base station has received the interception task, afeature value for each bearer of the interception target, forassociating the intercepted data with the corresponding bearer of theinterception target; and another transmitting unit configured totransmit the intercepted data carrying the feature value to theinterception proxy.
 17. (canceled)
 18. (canceled)
 19. An electronicdevice, comprising at least one processor and a memory connectedcommunicatively to the at least one processor, the memory storinginstructions executable by the at least one processor for performing themethod of claim 1.